PCNSE · Question #233
Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a "No Decrypt" action? (Choose two.)
The correct answer is A. Block sessions with expired certificates D. Block sessions with untrusted issuers. Even when a Decryption policy rule is set to 'No Decrypt', attaching a Decryption Profile still allows the firewall to inspect the SSL/TLS handshake metadata without decrypting the payload. This enables blocking sessions with expired certificates (A), since certificate validity…
Question
Which two benefits come from assigning a Decryption Profile to a Decryption policy rule with a "No Decrypt" action? (Choose two.)
Options
- ABlock sessions with expired certificates
- BBlock sessions with client authentication
- CBlock sessions with unsupported cipher suites
- DBlock sessions with untrusted issuers
- EBlock credential phishing
How the community answered
(38 responses)- A84% (32)
- B5% (2)
- C8% (3)
- E3% (1)
Explanation
Even when a Decryption policy rule is set to 'No Decrypt', attaching a Decryption Profile still allows the firewall to inspect the SSL/TLS handshake metadata without decrypting the payload. This enables blocking sessions with expired certificates (A), since certificate validity is visible in the handshake, and blocking sessions with untrusted issuers (D), since the certificate chain of trust is evaluated during the handshake. Blocking unsupported cipher suites (C) and client authentication issues (B) are more relevant to active decryption inspection. Blocking credential phishing (E) requires full decryption and URL inspection.
Topics
Community Discussion
No community discussion yet for this question.